Release: qualify and publish optional Graphify context in v1.4.1

[jeffhuber]

Part of #902.

Problem

The optional provider needs a clear install/setup path, reproducible scorecard, and release boundary after Devin v1.4.0.

Scope

Add the optional integrations picker entry, install/upgrade/docs, no-provider rehearsal, isolation/staleness tests, comparative benchmark, sanitized scorecard, version/release artifacts, campaign, Board verification, and allowlisted CodeMower.com metadata upload.

Dependencies

• Graphify: bounded query normalization and context packets #914 — bounded query/packet implementation.
• Docs: replace the nonexistent hosted-Devin work-order command #965 — supported command and current-roadmap documentation.
• Work orders: keep optional Gitar out of the default review lanes #967 — intended default review lanes.
• Release evidence: separate completion, provider exit, usage settlement, and cloud freshness #976 — independent release/operational acceptance evidence.
• Release: publish and qualify Code Mower v1.4.0 with Devin peer support #912 — Devin v1.4.0 release; already complete.

Acceptance criteria

• Default Claude + Codex installation gains no Graphify dependency or indexing step.
• The Context: evaluate official Graphify as a local repository provider for v1.4.1 #876 adoption thresholds remain satisfied on the release candidate.
• Fresh install, package matrix, full tests, privacy, current-head audits, and gate pass.
• v1.4.1 is published/installed/qualified before Board Release: publish and qualify Board clarity v1.4.2 #952; any evidence-backed Graphify deferral is explicitly recorded here and in Epic: Graphify local repository context for v1.4.1 #902/Roadmap through v1.5.0: bounded builders, Graphify, Board, and supervised Slack #900 before the dependency is considered satisfied.
• Uploaded data contains no graph, query, path, citation, or source content.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record the named builder, keep one writer on the branch, run focused tests and applicable full checks, obtain an independent Code Mower review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Update the parent epic with PR/head, review, validation, outcome, and safe metadata-only upload evidence. Do not put credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output in cloud data.

Updated completion mapping

One planned OSS release PR; planned builder Code Mower Codex with an independent qualified peer excluded from the exact diff contributors. Record merged-on-main versus actually published artifact inclusion, including #935/#973 and the stabilization changes shipped. Use #976 to record implementation/exit/review, known caps and unknown settlement, stored metadata, and observed aggregate freshness separately. A stale refresh is an explicit follow-up under #974, never a freshness pass. No runtime Graphify scope is silently dropped to meet a tag.

Owner-prioritized release prerequisite

The owner now requires v1.4.0 stabilization fully complete before v1.4.1 acceptance. Add #979 as a release dependency: all seven stabilization implementation children and #974 fresh-view verification must be complete, alongside Graphify #914. This strengthens the earlier #965/#967/#976 subset. Keep the v1.4.0 tag/assets immutable and record stabilized fixes in the verified v1.4.1 package. Board builders become the next priority after this release is published and qualified.

Hosted v1.4.0 adoption regression gate

The owner supplied a hosted Ubuntu/headless upgrade report. It verifies the v1.3.1-to-v1.4.0 install path, wrapper/version alignment, loopback Board serving/status/doctor/restart, lanes status, setup preview/drift and quiet opt-in integrations. Treat these as historical reported observations, not a new live qualification run or proof of a mutating/merge-authority role.

The report's bare-builder-init and irrelevant campaign-auth failures were fixed by #954/#969 and #953/#966 after v1.4.0 publication. Those are merged-on-main fixes until the candidate and published v1.4.1 artifacts are inspected and rehearsed. Do not reopen them solely because the v1.4.0 package reproduces the old behavior.

Required candidate and published-package checks:

• Verify the actual wheel/sdist and installed candidate and published v1.4.1 package include Doctor: scope release-campaign auth readiness to campaign intent #966/Init: preview --builders from the packaged starter in a fresh checkout #969/Honor repository branch-name policy before builder PR creation #971/Sessions: discover and validate the current checkout brief #973/Work orders: default to Codex and Claude reviews #980/Docs: replace the nonexistent hosted-Devin work-order command #981/Make builder takeovers quiescent and Git-capable #984/Release evidence: distinguish completion, exit, settlement and freshness #985/Enforce participant role qualification before new work #987/Report effective review authority and superseded Devin bridge drift #988, plus Builder takeover: make provenance, labels, and reviewer exclusion handoff-aware #963/Superseded: builder lineage prototype and recovery evidence #989 and Graphify: bounded query normalization and context packets #914/Graphify: bounded query normalization and context packets #982 once independently accepted. Bind the artifact names/digests, inspected contents and installed behavior to the reviewed release commit. A merged PR or source-tree pass alone does not satisfy published-package inclusion.
• Rehearse both cold installation and upgrade from v1.4.0 on headless Linux. Verify CLI, wrapper/pin, installed version and serving Board version agree after the supported restart.
• In a fresh repository, bare init --builders codex,claude,cursor produces a preview without writes; configured repositories preserve the selected config/profile. Invalid selections retain actionable errors.
• Ordinary no-campaign adoption has no campaign-auth owner action; explicit campaign intent reports isolated readiness truthfully. Unselected integrations remain quiet. Do not require a fixed warning total or treat warn/exit 0 as full activation.
• Eligible session creation visibly explains its mutating lease and exact release command; a new process can discover the holder and release using the same ID. Unqualified Devin orchestration acquires no lease. Show/read-only operations do not mutate state.
• Repeat loopback Board status/doctor/cache cold-to-fresh and supported stop/restart checks; retain path redaction. Persistent service ownership/selector enhancements remain Board: manage persistent services and reject stale keepalive bindings during release restart #961 for v1.4.2.
• Generated setup drift is previewed and explained before adoption; no blanket overwrite or automatic repository token/auto-merge enablement. Preserve reviewer gates as informational where configured.
• Execute the optional Devin prompt-pack walkthrough from each installed candidate and published package in both a fresh repository and an explicitly configured repository. Initial starter discovery uses doctor --packaged-starter --profile PROFILE --devin; preview/staging preserves that profile and does not change active setup. After generated setup is reviewed and installed, verification must use the installed repository file (doctor code-mower.yml --profile PROFILE --devin for starter adoption, or the original explicit CONFIG), never the immutable packaged starter. Correct the prompt pack's ambiguous “rerun the doctor command above” instruction and prove text/JSON remediation preserves the selected configuration/profile without embedding the package installation path.
• Inspect the shipped quickstart, session docs and orchestrator prompt pack together: they explain eligible session lease creation, holder discovery, same-ID cross-process release/renewal, read-only alternatives and the maintained 12-hour default; they do not claim Devin orchestration qualification or repeat the report's approximate 24-hour observation as current behavior.
• Release notes state the remaining headless adoption limitations explicitly: repository-aware board stop --repo remains Board: manage persistent services and reject stale keepalive bindings during release restart #961 for v1.4.2, and supported isolated non-keyring Codex campaign authentication remains Campaign: support isolated Codex authentication on headless Linux #983 after v1.4.1 and before v1.5.0. Document currently supported stop selection; quiet ordinary adoption does not prove optional campaign readiness.

Secure non-keyring campaign authentication is separately planned in #983 after v1.4.1, before final v1.5.0 qualification. Normal doctor must not require that unused capability. No new paid hosted session is authorized by these rehearsal criteria.

Accepted prerequisite update

#976/#985 is merged with exact-head independent Claude PASS and all CI/gate checks. #974 storage and current authenticated aggregate visibility are independently verified and closed. These satisfy their prerequisite units; they do not replace candidate and published-v1.4.1 package verification or release-specific freshness checks. #962/#984 is also accepted after independent exact-head Claude PASS, all CI/gate checks and verified writer quiescence. #975/#987 is accepted after independent exact-head Claude PASS, 3,565 local tests with 12 skips, the full CI matrix and authoritative gate; it merged as c542536d68a5774d5c7db5d2f33a0e860e908872 after writer quiescence and lease release. #955/#988 is also accepted: independent exact-head Codex PASS on d52782405b18d7e280a1330748daccccb0e9a74b, 3,658 full local tests with 16 skips, 75 adoption regressions, full CI and authoritative gate; merged as db4506d2b3232e4c6a7c5683251eeb536b2b8355 after writer quiescence and lease release. Seven of eight #979 units are accepted (six implementation children plus #974 freshness); only #963/#989 remains open in that epic. Graphify #914/#982 remains a separate prerequisite. These accepted source results do not satisfy the candidate/published-package checks above. #988 fixed runtime starter-to-installed verification; the prompt-pack clarification and literal installed-package regression above remain #915 release work.

Keep #915 open through the #876 comparative scorecard, actual publication/install qualification, campaign/Board checks, stored metadata receipt and fresh authenticated aggregate view. The release PR should use Refs #915; close this issue only when every release acceptance criterion is verified. This supersedes the earlier work order's automatic “PR closing #915” wording.

Lineage prerequisite decomposition

#963 remains the sole open #979 outcome, but its unaccepted draft #989 no longer follows a serial repair loop. Completion is now staged through #990 (pure exact-head contract), #991 (trusted delivery/publication), and #992 (atomic admission/status/labeler/runner integration), each with one independently accepted PR. Require all three stages and the final actual-consumer matrix on main before Graphify #982 is refreshed and release source work starts. Preserved #989 head 0706c53922f67168dfbb6d2a6493a031a9b0f205 has passing bounded checks/CI but a confirmed unresolved no-label-mutation invariant and is not release evidence. This supersedes references above to accepting #963 through #989; candidate/published artifact inclusion must bind the replacement merge commits. All other release criteria remain mandatory.

[jeffhuber]

Bounded Code Mower release work order

Start the release source writer after #914 and the entire stabilization epic #979 are accepted. One Code Mower Codex writer on an isolated release branch, one draft PR closing #915, and an independent qualified Code Mower Claude audit on the final diff. The root orchestrator serializes merge and publication after current-head CI/gate passes.

Update optional Graphify setup, supported user guidance, release notes, current-version references and committed package materialization for v1.4.1. Preserve the original v1.4.0 tag and artifacts. Reconcile independently owned changes already merged to main into the final candidate; do not silently discard them or reopen completed fixes based on the old package.

The release evidence matrix must cover:

1. Source and artifact identity. Bind the release PR merge commit, annotated tag, workflow identity and expected head. Verify wheel/sdist contents include the required post-v1.4.0 implementations and required package mirrors. Run the complete package/test/privacy/release-readiness checks from a fresh clone, then the no-publish distribution workflow. Bind candidate and canonical-PyPI artifact names/digests to the approved build before claiming inclusion.
2. Actual optional Graphify compatibility. Verify the approved exact wheel pin and run maintained code-only/no-cluster extraction through Code Mower containment on an immutable tracked public checkout. Query and guided delivery must consume the emitted raw format and bind the consuming revision. Re-run the Context: evaluate official Graphify as a local repository provider for v1.4.1 #876 comparison set and thresholds, bounded outputs, citation resolution, staleness/completeness and no-provider fallback. Synthetic fixtures alone are insufficient. Record failed preliminary runs and their corrected causes honestly.
3. Headless adoption. Rehearse a cold install and upgrade from v1.4.0 with the supported uv/Python3.12 path. Verify actual version, wrapper and serving Board agreement, normal doctor posture, optional integrations, bare builder-init preview, configured-profile preservation, visible lease creation/discovery/cross-process release, no lease for unqualified orchestration, and setup drift without automatic owner configuration changes. Record the actual OS/architecture and credential posture; a local container is not a hosted Devin canary.
4. Release-specific participant qualification. Update the version-specific runbook to the authorized v1.4.1 participant scope, preserving historical v1.4.0 campaign truth. Normal Claude/Codex defaults and optional read-only Graphify checks must not inherit an old mandatory paid Devin-create step. Do not mark unrun provider execution as passed or create new hosted sessions from a stale runbook. Any later live hosted campaign requires its own explicit allowance.
5. Post-publication acceptance. Install the exact canonical published package, run the published-package qualification and upgrade checks, verify supported Board restart/status/privacy, inspect the metadata-only upload preview, assert the stored receipt, and observe fresh authenticated aggregate visibility separately. Do not replay accepted receipts or infer settled billing from observed zero usage. Release evidence: separate completion, provider exit, usage settlement, and cloud freshness #976's local evidence is a report of verified observations, not a substitute for those checks.

Fix all P0/P1/P2 findings and obtain a fresh review if the release head changes. Keep raw logs, account bindings, provider references, source/query/graph content and private paths in authorized local evidence only. Update #902/#979/#900 with source, publication and qualification states separately. Only after all required acceptance evidence passes does Board v1.4.2 become the active delivery priority.

[jeffhuber]

Release-source activation on accepted main

The serialized prerequisites are now accepted. #997 merged as 0b5fdcf78fe0ec7d76042fbdae5e4d3c5849c514; #963 is closed; Graphify #982 merged as current main 6e880e982248dbfdcef63ed9afc345cb0b60cbda with qualified tree 4abc24bcb2b97ed7554a18ae10a45d328c709558.

Activate one Code Mower Codex source writer from that exact main and produce one draft PR with Refs #915. Keep the release source PR separate from tag, package-index publication, installed-package acceptance, campaign, Board, and cloud operations.

Use the prepared boundaries already recorded on this issue, with these final scope decisions:

• Package and current release identity become 1.4.1; preserve the v1.4.0 runbook and historical notes unchanged. Versionize current release-readiness assertions without weakening SHA, tag, artifact, origin, or publication gates.
• Add a narrow opt-in init --graphify guidance selector. It may render reviewed separate-environment acquisition and pin guidance for accepted Graphify 0.9.58, but it must not install, index, invoke Graphify, add a base dependency, or enable context by default. Ordinary init remains inert and quiet.
• Update the orchestrator prompt pack so starter discovery uses the packaged starter, then explicitly switches to the installed repository config/profile after reviewed setup installation. Preserve profile/config selection in text and JSON.
• Document the maintained 12-hour session lease default, holder discovery, renewal, and same-ID cross-process release. Do not repeat the old report's approximate 24-hour observation.
• Release notes must disclose that repository-aware Board stop selection remains Board: manage persistent services and reject stale keepalive bindings during release restart #961 for v1.4.2 and isolated non-keyring Codex campaign authentication remains Campaign: support isolated Codex authentication on headless Linux #983 before v1.5.0. Quiet ordinary adoption is not optional campaign readiness.
• Retain installed lineage qualification hooks from Activate atomic lineage consumers and supervised producers #997 and a post-publication replay path that uses the downloaded package without checkout/source substitution.

Run meaningful focused checks, but leave the canonical one-time full suite, exact-head independent Claude review, CI/gate, merge, and release operations to the supervisor. Do not close #915 from the source PR and do not claim v1.4.1 is published.

[jeffhuber]

Codex source-writer handoff

Prepared draft PR #998 from accepted main 6e880e982248dbfdcef63ed9afc345cb0b60cbda.

Head: 288ba2ace7a7e68ba3ee4089d14c8aebf2ff77a5. Named builder and sole branch writer: Code Mower Codex. Labels: builder:codex, needs-claude-audit. Working copy is clean; no additional source writing is planned by this lane.

The source candidate sets version 1.4.1, adds guidance-only init --graphify for the accepted 0.9.58 pin, corrects starter-to-installed config/profile verification, documents the 12-hour lease and headless limitations, preserves v1.4.0 history verbatim, and retains downloaded-wheel qualification hooks. Release/adoption docs are included in the sdist and the committed package manifest is refreshed.

Validation passed: 127 focused release/runbook tests; 72 Devin setup tests; 20 adoption/documentation checks; 10 cold builder-init tests; 7 documented-command tests; 4 guidance/installed-wheel walkthrough tests; and 4 scoped lineage artifact tests. Release readiness is 20/20; Ruff, privacy, package workflow guard, compileall and diff checks passed. Local sdist contents and unchanged historical docs were inspected. These are source validation results, not approved candidate/published-package evidence.

One installed lineage takeover/public-readback replay remains unqualified locally: this runner nests temporary state inside a Git checkout, and the existing context-store guard refuses it. The exact attempted command was PYTHONPATH=src:tests python -m unittest discover -s tests -p test_lineage_producer_artifacts.py. A TMPDIR=/tmp attempt also fell back inside the checkout. Four scoped artifact tests passed afterward; the supervisor must run the remaining hook with writable temporary storage outside Git. No product guard was changed.

Source: draft, not merged. Independent exact-head Claude review: requested, pending. Canonical full suite and CI/gate: supervisor-owned, not claimed passed. Publication/tag/installed release qualification: not performed. #876 comparative scorecard, campaign, Board, cloud preview/upload/receipt and fresh authenticated aggregate: pending. No hosted sessions or cloud uploads were performed; there is no new stored receipt or freshness claim.

Supervisor actions:

1. Resolve PR linkage before source-only merge: the runner's hard contract required Closes #915, but the owner's activation requires Refs #915. The PR is draft and Release: qualify and publish optional Graphify context in v1.4.1 #915 is still open. Remove the closing reference before merging source independently; keep Release: qualify and publish optional Graphify context in v1.4.1 #915 open through all release acceptance.
2. Run the canonical full suite with temporary state outside Git; obtain independent qualified Claude review on this exact head, resolve all P0/P1/P2s and pass CI/code-mower/gate.
3. Serialize the owner-authorized merge/release and the separate candidate, canonical published-package, scorecard, campaign, Board and metadata/freshness acceptance described in docs/v141-qualification.md. Preserve v1.4.0 assets.

[jeffhuber]

Mac lane runner (codex): this run ended without a validated delivery. The unit stays open for the next cycle.

• provider exit: 0
• supervision: completed
• observed transition: none
• classification: exit_zero_without_delivery

[jeffhuber]

v1.4.1 publication and qualification complete

The optional Graphify release is published and accepted. Source PR #998 merged as d52bc68396397edfeae782d08a768386f89a00f2 after an independent exact-head Claude PASS with zero P0/P1/P2 findings. The canonical full suite passed 4,245 tests, and required CI plus code-mower/gate passed.

Published identity

• Annotated tag and GitHub Release: v1.4.1 at the accepted release commit.
• No-publish build workflow: run 35085780408.
• TestPyPI publication: run 35085878476.
• Production PyPI publication: run 35086105766.
• Release-event verification: run 35086359968.
• Canonical wheel SHA-256: 54cc28ed10fb1083794205fa51f9e39d30d314939c2308748f8ec95faf29e39e.
• Canonical sdist SHA-256: 2217073f9c43b1f0328076309f87d0d842e66d965e703ffe0f5b2fbdbf0e1568.
• Candidate and canonical artifact contents, installed version, release commit, and required stabilization/Graphify changes were cross-checked.

Installed-package acceptance

• The canonical wheel passed the installed lineage producer/public-readback and Devin prompt-pack replay: 3 targeted end-to-end tests passed in 10.1 seconds.
• A preliminary replay accidentally imported the editable live checkout and failed on a missing symbol. Re-running with the isolated release Python and the exact downloaded wheel removed that environment leak and passed; no product change or waived assertion was involved.
• Headless Linux aarch64, Python 3.12.14: cold-installed 1.4.0, upgraded to canonical 1.4.1, initialized a fresh repository with the recommended Codex/Claude/Cursor setup, generated 46 files, exercised the public v1.4.1 wrapper pin, prepared a Codex session without a lease, and verified Board serving=installed=1.4.1 with no restart recommendation.
• The slim container could verify Board identity but could not enumerate the listener for supported board stop; container destruction removed the listener. Host-side supported stop/restart checks passed. Repository-aware persistent service selection remains Board: manage persistent services and reject stale keepalive bindings during release restart #961 for v1.4.2.

Real Graphify scorecard

The accepted graphifyy==0.9.58 wheel (e239803288e91c723d6e30540860bd6d5a1dc3f0914b9fc1104b0233e98aaeb8) ran in a private managed Python environment against the immutable release checkout, code-only and without clustering. The successful contained build used --max-workers 1:

• 746 tracked files, 0 unsupported inputs.
• 22.138-second cold build; 52,858,880-byte graph.
• Revision/tree provenance matched the accepted release exactly.
• Four of six graph-suited comparison questions produced useful incremental relationships, satisfying the “at least half” adoption threshold.
• All 58 sampled relevant line citations resolved inside the immutable checkout; completeness and truncation were explicit.
• The exact-text negative control, stale-revision refusal, and no-provider fallback behaved as required and wrote no misleading packet.

The related-tests query returned no target result, and the path-level blast-radius result was useful but noisy. A Homebrew runtime was correctly refused because its linked-library ancestry was group-writable; the managed environment was used instead. The default parallel build failed under containment, while the documented provider option limiting workers to one completed inside every resource/privacy cap. Graph/query/source/path content remained local and was not uploaded.

Campaign, Board, privacy, and cloud acceptance

• The release campaign completed with Claude PASS and Codex pass_with_warnings; no blocking finding remained.
• All three existing Boards were restarted onto 1.4.1 and reported matching installed/serving versions. Doctors passed; one documented owner-queue warning remained informational.
• Metadata-only campaign and Board-snapshot previews/uploads were accepted. No graph, query, citation, path, source, prompt, transcript, credential, or provider output entered cloud data.
• Fresh authenticated aggregate readback showed “Processing is current,” queue “Caught up,” 0.0-second lag, a fresh accepted/evaluated upload, and no processing error. The dashboard separately reports unavailable reconciliation read-model cleanup; that is a data-hygiene follow-up rather than an ingestion-freshness failure.

Release notes retain the remaining boundaries: persistent repository-aware Board service management is #961 for v1.4.2, and isolated non-keyring Codex campaign authentication is #983 before v1.5.0. No hosted Devin session was created for this release qualification.

Every #915 acceptance criterion is satisfied. v1.4.1 is published, installed, and qualified; Board v1.4.2 may now become the active roadmap priority.